The Grove Foundation
CIO Alert · Structural Custody in Agentic AI · Published July 21, 2026

A technical audit of trajectory harvesting and zero-data-retention boundaries.

How agentic coding vendors legally decouple the protected "Customer Data" from the human reasoning trace that produced it — and harvest the latter at industrial scale.

Our lane

We are technologists, not attorneys. We report two things only: what these systems capture, and what the vendors’ own terms literally say — both verifiable right here. What a court would make of any of it is a question for your counsel, not us. Nothing here is legal advice or creates an attorney-client relationship. Verify every claim in the Evidence Library →

For CISOs · Enterprise Architects · Practitioners  ·  CC BY 4.0  ·  the-grove.ai
The Finding

“We Don’t Train on Your Data” Is Technically True

Leading AI vendors quietly redefined what counts as yours.

Over the last 14 months, major AI coding and agentic platforms quietly expanded an old SaaS term — “Usage Data” — far beyond what it used to mean. What was once just uptime logs and crash reports now includes the detailed record of how employees reason, correct, and decide.

Plain-text training has hit diminishing returns. The most valuable asset in an enterprise AI contract is no longer the customer’s data they want to protect. It’s the “reasoning trace” — captured through the telemetry these systems collect by design, and exactly the kind of signal needed to improve the reasoning capabilities of the next generation of models.

In traditional cloud and SaaS agreements, “Usage Data” or “telemetry” meant narrow operational metrics: server uptime, latency, memory diagnostics, crash reports. The actual customer data, designs, content and cognitive flow of how people worked stayed in the protected Customer Data bucket that enterprises negotiate and audit.

That boundary has been redrawn with remarkable consistency. Leading platforms have expanded “Usage Data” to include reasoning traces: which suggestions are accepted or rejected, what gets edited, how decisions are made, and the execution paths that follow. In the most striking case, the definition of Usage Data remained word-for-word identical across a 14-month window while the surrounding terms added an outright ownership claim — “all right, title, and interest” — and flipped model training from opt-in to opt-out. The words held still. The meaning inverted.

Because these agreements carve Usage Data out of the Customer Data category enterprises traditionally negotiate, the standard safeguards — deletion rights, training opt-outs, zero-retention commitments — do not reach it. Where the terms assert ownership, no opt-out for that category exists at any tier or setting, and structurally none can: you cannot opt out of someone else’s property.

De-identification and aggregation — long presented to customers as privacy protections — function as the transfer mechanism. One provider’s privacy policy exempts content already de-identified from its own 30-day deletion commitment. Another retains embeddings and codebase metadata after the underlying plaintext is deleted. A third states that once data is de-identified, it may be used and shared for any purpose — and that its privacy policy no longer applies to it. In each case, the customer’s identity is removed from the record while the reasoning pattern stays with the vendor.

Retention is not theoretical. In active litigation this year, a federal court ordered one provider to preserve and produce approximately 20 million de-identified consumer conversation logs — demonstrating that retained data remains reachable by discovery and acquisition regardless of any training promise.

One precision up front: what we can prove is custody and title — what these standard terms hand the vendor. Whether any given vendor is training on your traces today is, by design, unprovable from the outside. Closed-weight systems mean no customer can inspect how the model was trained. Training is the logical reading of the public record, current efforts in computer science, and the real limits of the “plain text internet.” But the claim that needs no inference is ownership. The contracts put that beyond dispute. Negotiate from an informed position.

The defense already exists

Enterprises should negotiate Usage Data definitions with the same rigor they already apply to Customer Data. They should also evaluate architectures that keep telemetry, memory, and reasoning traces under their own control. The Grove Foundation published the Autonomaton Pattern (GRV-001) under Creative Commons BY 4.0 for exactly this purpose: an open architectural standard that makes operator ownership of institutional reasoning a structural property of an agentic system rather than a contractual hope.

Read the Autonomaton Pattern (GRV-001) →
The research behind this alert

Q2 2026 Λ Standings

All five Approaching-Critical patterns this quarter are Sovereign open-weight — DeepSeek V4, Mistral, Gemma 4, GLM-5.2, and Qwen 3.6 — the models an enterprise can download, run, and keep. The strongest closed API pattern sits a full tier below. The market is repricing structural viability toward the models a company can hold — the same custody logic this alert traces from the other direction.

Read the full Λ Standings →

The full analysis — including the cross-vendor matrix, 14-month custody ratchet, provider-level exhibits, and every primary-source citation with verification hashes — appears below. Every load-bearing claim is fact-checked and linked.

Cross-Vendor Convergence Matrix

Every major vendor converged on the same legal architecture in under 14 months.

Industry-wide standardization of trajectory harvesting. Even in “protected” environments, vendors systematically capture behavioral reasoning traces.

Vendor
Protected Customer Data
Vendor-owned "Usage Data"
ZDR?
Key trace elements captured
Windsurf
Cognition
Prompts + source code (excludes Usage Data §1.2)
Anonymized interaction manner; absolute title §3.3.2
No
Full multi-step planning timelines + every human accept/reject decision + post-suggestion edits and corrections
Cursor
Anysphere
Plaintext — only if Privacy Mode ON
Editor actions, embeddings, indexing metrics
No
How developers edit or reject AI suggestions + the semantic structure and relationships of their entire codebase (Levenshtein distance, semantic embeddings, repo maps)
Claude Code
Anthropic
Prompts, source code, outputs returned
Operational metrics + all /feedback & survey transcripts
No
Complete session transcripts + explicit human feedback/ratings + full Slack channel history and decision context
GitHub Copilot
Microsoft
Repo code + explicit chat prompts
Server-side metrics, LoC arrays, agent-mode logs
No
Detailed patterns of how developers modify suggestions + multi-file iterative reasoning flows across the repository
Replit
Private / Enterprise Repl code
OT timelines, diagnostic traces, execution patterns
No
Keystroke-by-keystroke repair behavior + error diagnosis paths + sequences that lead to passing tests
OpenAI
Enterprise / API
Protected endpoint payloads
De-identified & disassociated content
No
All "de-identified" interaction patterns + human corrections and verification loops
The core point: ZDR protects code, PII, etc. It does not protect the reasoning trace.
Verify → A4 C5
Broader Recognition · Not just The Grove Foundation or Alex Karp

The industry's own leaders name the same asymmetry.

"In the AI age, the buyer risks giving away knowledge, just in order to use what they bought… Models learn from ‘exhaust,’ the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong. Every correction is distilled into institutional know-how."
Satya Nadella · Microsoft CEO · "The Reverse Information Paradox" · July 12, 2026
Same asymmetry

Enterprises pay for intelligence while simultaneously feeding vendors the proprietary reasoning traces that make the models more powerful.

The prescription

A "real trust boundary" so organizations retain ownership of their traces, evals, memory, and institutional context.

Echoing Karp

Control over "compute, models, data stack, and alpha" — owning the means of production so learning isn't transferred to the vendor.

Verify → A15 A14
What changed? The Data Wall & the pivot to trajectories

From training on verified text to training Process Reward Models.

The Exhausted Substrate

High-quality training text is depleted. Training on unverified synthetic data — feeding the system its own output — triggers Model Autophagy Disorder (MAD): exponential perplexity degradation, erosion of minority distributions, and systemic homogenization within successive generations.

The New Premium Fuel

Process Reward Models (PRMs) require execution-feedback-enhanced trajectories: the step-by-step record of plan → execute → error → diagnose stack trace → adapt → pass test. This authentic "semantic resonance" cannot be synthesized in a vacuum without triggering autophagy — it must be harvested from real human operators.

Why this matters for custody

Traditional Outcome Reward Models evaluate the final output only. PRMs assign dense, stepwise mathematical rewards to every intermediate step. To train them, vendors need the full granular trajectory — not just the code, but the exact sequence of human corrections, error diagnostics, and verification loops. This is the cognitive trace now being extracted at industrial scale through agentic IDE telemetry pipelines.

Verify → C6
Agentic IDEs as Cognitive Keyloggers

The agent harness / IDE has been re-engineered as a high-fidelity telemetry array.

Autonomous coding harnesses no longer function merely as productivity accelerators. They are structurally integrated arrays that capture the operational graphs and cognitive trajectories of enterprise knowledge workers — the exact reasoning paths needed to train next-generation PRMs.

Cursor Windsurf · Devin Claude Code GitHub Copilot Replit OpenAI
Code suggestion acceptance

Tab-accept and reject signals, post-accept edits, the Levenshtein distance between suggestion and shipped code, and developer_modified_ratio.

Diagnostic & execution loops

Terminal stack traces, LSP diagnostics, error-resolution timelines, and multi-step agent planning graphs captured via Operational Transformation.

Semantic & structural maps

Codebase embeddings, repository hierarchies, cryptographic file hashes, and in-situ context feeding the CSAP models.

Verify → C7 A11
The Legal Bifurcation Architecture

How vendors redrew the data-custody boundary.

Legacy cloud terms treated "telemetry" as server uptime, crash reports, and infrastructure metrics; the interaction payload — code, plans, files — was protected user content. Agentic vendors surgically decoupled the two.

Customer Data
The protected bucket
  • Literal prompts and source code
  • Generated outputs returned to the user
  • ZDR applies — "not saved to disk… deleted upon generation of Output"
  • User retains all rights
But: expressly excludes Usage Data.
Usage Data
The harvested bucket
  • "Anonymized / aggregated" manner of interaction
  • Reasoning traces, embeddings, CSAP metrics
  • OT timelines, LSP diagnostics, Levenshtein distances
  • Vendor claims absolute title — "all right, title, and interest"
ZDR does NOT apply.
Verify → A1 C2
Cognition · Windsurf & Devin

The explicit custody ratchet — executed in plain view.

Platform Terms of Service · evolutionary audit April 2025 → June 30, 2026
"Cognition reserves the right to collect, analyze, and utilize Usage Data… Cognition owns all right, title, and interest in and to the Usage Data."
— Section 3.3.2, Cognition Platform ToS (June 30, 2026)
The legal triad that nullifies ZDR
§3.1User retains rights to Customer Data (prompts + generated source code).
§1.8ZDR defined — data "not saved to disk… deleted upon generation of the relevant Output."
§1.2Customer Data "expressly excludes Usage Data."
§1.7Usage Data = "anonymized and aggregated data regarding the manner… you interact with the Services."
§3.3.2Absolute ownership asserted over Usage Data.
Result: ZDR is legally valid — but applies only to the depreciating asset (raw text). The premium asset (the reasoning trace) is vendor property by contract.
Verify → A1 C1
OpenAI · Enterprise & API

"De-identification" as an ownership-transfer mechanism.

A standing exemption removes any content already "de-identified and disassociated from your account" from the scope of deletion requests. Once a trajectory is stripped of regulated identifiers and reduced to an abstract interaction graph, it is relabeled as de-identified telemetry — and the enterprise's right to delete ceases.

"De-identified" is a database label — not a legal firewall. Once applied, the reasoning trace becomes vendor analytical property, outside deletion rights and ZDR scope.

NYT v. OpenAI · November 2025

A federal court ordered the preservation and production of approximately twenty million consumer ChatGPT logs — explicitly including conversations users believed they had permanently deleted.

Proven in open court: de-identified data retained on a vendor server is structurally preserved and legally reachable by subpoena — regardless of any UI deletion assurance.

Verify → A5 B1 C3
Claude Code & GitHub Copilot

Operational logging that captures cognitive flow.

Anthropic · Claude Code
  • Logs operational metrics from the local machine to Anthropic servers.
  • Tracks "latency, reliability, and general usage patterns."
  • In multi-step loops, patterns reveal how tasks are mapped, delegated, resolved.
  • /feedback & Session Quality Surveys trigger full transcript upload — including proprietary code — to Google Cloud Storage.
  • Feedback data retained up to 5 years; de-linked from user ID.
  • Claude Tag in Slack passively absorbs channel history and decision context.
  • Anthropic makes no ZDR gesture for Claude Tag at all: it "retains channel memory and session transcripts," so it "isn't available to organizations with Zero Data Retention (ZDR) enabled."
GitHub Copilot
  • Server-side telemetry identifies users for engagement totals even when client-side telemetry is disabled by corporate policy.
  • Captures detailed LoC metrics: loc_suggested_to_add_sum, loc_added_sum, loc_deleted_sum.
  • Explicitly ties metrics to agentic features: chat_panel_agent_mode, agent_edit.
  • In agentic modes, systematically tracks multi-file edits iteratively across the entire repository.
  • Captures the full flow of logic across the repo ecosystem.
Verify → A10 A9
Cursor · Anysphere

The plaintext perishes, but a high-value, structural blueprint remains.

Data Use & Privacy Policy · last updated June 9, 2026
The bifurcation of physical custody

With Privacy Mode manually on, plaintext inputs get ZDR — chunks are uploaded to compute multi-dimensional embeddings, then deleted "as soon as the lifecycle of that indexing request is completed."

However: the resulting embeddings, exact file names, repository hierarchies and cryptographic hashes are permanently retained in Cursor's backend clusters. The enterprise shreds the paper copy; the vendor keeps the blueprints.

Why embeddings beat raw text

Embeddings preserve the mathematical topography of the architecture — semantic relationships, naming conventions, module dependencies, decision patterns — without literal syntax. This is the perfect PRM substrate: dense, contextual, and already de-identified.

By classifying the embedding as an "operational product of the service" rather than protected Customer Data, Cursor legally retains a perfect topological map — outside ZDR and deletion rights.

Verify → A3
The Receipts · A 14-Month Custody Ratchet

“We won’t train on your data” became “we own the map of how your company thinks.”

Apr 2025
Cognition
Training on customer data was opt-in only. Usage Data carried no ownership claim.
Prior terms — vendor archive
Oct 2025
Cursor
A “de-identify and keep” regime begins. Accounts after this cutoff fall under broader data-sharing terms.
cursor.com/data-use
May 2026
Cursor
Deletion stops at the plaintext. The delete button no longer reaches de-identified content.
cursor.com/data-use
Jun 9 2026
Cursor
Privacy Mode still retains embeddings — a permanent semantic map of your code’s structure and logic.
cursor.com/data-use
Jun 30 2026
Cognition
“Cognition owns all right, title, and interest” in Usage Data — including the reasoning trace itself. Not retained. Owned.
§ 3.3.2 — the endpoint

Five documented beats in fourteen months. Each one transferred more custody of how your company thinks from the enterprise to the vendor.

Every step is timestamped on the vendor’s own site — the April 2025 terms are still linked from the current page. Legal teams do not move this fast, in this direction, by accident.

Verify → A2 C4
The Trace Extractor Mechanics

Cognitive keyloggers: CSAP, Levenshtein & OT logging.

Code Suggestion Acceptance Prediction

Lightweight binary classifiers predict the likelihood of acceptance before ghost-text even renders. Trained on three dimensions:

·Developer Habit — historical acceptance counts, modification frequency, generation intervals.
·Project Preference — repo-specific architectural acceptance ratios.
·In-Situ Context — IDE version, preceding code semantic density.

~70% of suggestions are rejected → imbalanced data → a class-balanced weighted cross-entropy loss achieves 0.973 accuracy at labeling developer preferences. Post-accept, the harness computes the developer_modified_chars and developer_modified_ratio — mapping the enterprise's style without owning the files.

Intermediate Planning & LSP / OT Logging

Advanced tools (Windsurf Cascade, Replit agents, Copilot agent_edit) run multi-step reasoning loops. Vendors log the complete execution graph via OT timelines:

plan multi-file execute bash compiler error read stack trace adjust params query LSP rewrite function

PRMs require dense stepwise evaluation — so terminal stack traces, execution latency and raw LSP diagnostic logs route to the vendor backend under "diagnostic / analytical" clauses, classified as Usage Data, bypassing Customer-Data ZDR and capturing the exact cognitive path to resolution.

Verify → A11
The Logical Enforcement & Loopholes

Privacy modes, feedback overrides & poison pills.

Privacy-Mode Overrides

Cursor's Privacy Mode claims ZDR with inference providers. However:

  • Unilateral right to run "Abuse & Violation Classifiers" on all data. If triggered, ZDR is silently suspended.
  • Local / server caching routes all prompts through backend infrastructure (unless a legacy grandfathered account).
  • Opaque, vendor-set algorithmic threshold for abuse triggers.
Feedback Override · "Thumbs-Up"

The most pervasive ZDR circumvention in the industry:

  • /feedback or a UI rating uploads full conversation history — including proprietary code — to vendor GCS, bypassing standard retention.
  • Retained 5 years (Anthropic) or 6 months (surveys); de-linked from user ID → Usage-Data bucket.
  • A single thumbs-up from one junior dev voids org-level ZDR.
  • Claude Tag in Slack amplifies: entire channel history becomes a 5-year training asset.
Poison Pills & Safety Mandates
  • Windsurf: opting out of training on Free/Pro disables Chat & Cascade — reducing the tool to a legacy editor. Privacy requires an expensive Enterprise tier + months of DPA negotiation.
  • No BAAs offered → incompatible with HIPAA / strict compliance.
  • Q2 2026: Anthropic Fable 5 / Mythos 5 mandated 30-day minimum retention even on AWS Bedrock — voiding prior ZDR.
  • June 12, 2026: a Commerce Dept. export control forced a global API shutdown — enterprises paralyzed without warning.
Verify → A6 B2 B3 B4
Actionable Defenses for Enterprise Compliance

Four structural, non-negotiable architectural defenses.

01
Redline "Usage Data" in DPAs

Expand Protected Customer Data to explicitly include CSAP metrics, Levenshtein edit distances, codebase embeddings, LSP diagnostics, OT timelines, and all multi-step agent interaction logs. Do not let them default to ambiguous telemetry carve-outs.

02
Nullify Feedback Overrides

Contractually bar individual actions (thumbs-up, /feedback) from overriding org-level ZDR — then enforce it technically with fleet-wide env vars:

DISABLE_TELEMETRY=1 · CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 · DISABLE_ERROR_REPORTING=1 · DISABLE_FEEDBACK_COMMAND=1
03
Mandate Honest Ceilings + S3 Sinks

For Bedrock / third-party inference, route all invocation logging — full request/response, terminal errors, token metrics — exclusively to customer-owned S3 / CloudWatch. The vendor inference environment must be structurally blind to execution logs.

04
Transition to Sovereign Architectures

Move from black-box APIs to open declarative standards (Linux Foundation AGENTS.md, Grove Autonomaton / GRV-001). Enforce "Digital Jidoka": agent memory, tools and telemetry live in Git-tracked, enterprise-owned repositories. Bits move; meaning stays put.

Verify → A8
The Convergence · GRV-001 · The Autonomaton Pattern

The industry is converging on the fix. It stops one file short.

Today · Vendor-resident telemetry
Proprietary black box
Rules and memory live inside the vendor. You can’t read them, can’t move them, can’t prove what happened.
The industry converges
AGENTS.md · .agents
Rules and memory in version-controlled files. Portable, readable, yours — but still just an instruction.
The standard · GRV-001
Structural sovereignty
The same principle, made architectural — behavior the architecture guarantees, plus a record you own.
AGENTS.md
The Autonomaton
Portability
 Your file, your repo
 Same file, plus your telemetry and skills
Enforcement
 The model may ignore it
 The dispatcher owns the run; the model cannot reach state
Cost trajectory
 Flat — every turn is a frontier call
 Ratchets down: T3 → T0 as patterns confirm
Accumulation
 A file learns nothing
 Every approval is a labeled training example you own

A file you own is table stakes. A system that cannot exceed it — and a record that grows more valuable every time you use it — that’s the standard.

the-grove.ai/standards/001 · GRV-001 v2.0 · CC BY 4.0
Verify → A17 C8
The Trace, Made Legible · Grove Autonomaton — Operator Portal

What a reasoning trace looks like when you own the telemetry.

The same signal the vendors bank as Usage Data, running inside operator-owned software. The model-independent agentic system (autonomaton harness) clustered ten memory records around an emergent theme, checked them against its tracked goals, found none, and proposed a precise amendment to its own goal file — in this case, evidence-linked and staged for human review and approval by design.

The chain, made auditable
01
Raw memory
Ten records accrue in the substrate — each timestamped and addressable by ID.
02
Pattern detection
The system names an emergent cluster: Platform Independence.
03
Gap analysis
It checks its tracked goals and reports the finding: “No Dock goal tracks this.”
04
Structured proposal
It emits a machine-readable diff to its own goal file — staged, not self-applied, pending operator approval.
Four such clusters surfaced from overlapping memory on a single day — the system reasoning about its own strategic focus, in the open.
grove-autonomaton Operator Portal · Proposals dock_mutation
10 memory records accumulating around ‘Platform Independence’. No Dock goal tracks this. Add a staging goal?
dock.autonomaton.yaml:
goals:
+add:
id: auto-platform-independence
name: Platform Independence
keywords:
- model independence
- orchestration
- open standards · open-weight · harness
vector: personal
status: staging
▾ evidence (10)
mem_db4b21cemem_0a9a546emem_50d8fff9mem_027b13ccmem_41ec9c35mem_59b86cffmem_5138754emem_ff0eace5mem_55a42ccemem_f5261b66
created 2026-07-13T18:58:29.769345+00:00
Approve Reject Dismiss

The vendor keeps this as opaque telemetry. The autonomaton hands the operator the whole chain — evidence, reasoning, and a veto.

State of the Architecture · OpenRouter

The open surge — a volume takeover.

Chinese Open-Weight Share of U.S.-Company Tokens · Weekly
DeepSeek, Qwen, Z.ai & peers
50% 35% 20% 5% 0% Above 30% every week since Feb 8, 2026 11% — trailing 12-month average 4.5% · H1 2025 avg 46% peak JAN 2025 JUL 2025 JAN 2026 JUL 2026

A rounding error two years ago; roughly half of some weeks’ volume now. Enterprises are voting with volume for a sovereign, multi-model stack — where the trace never leaves the building.

Source: CNBC / OpenRouter · July 7, 2026
Verify → A12
The Telemetry Trap · Output API Pricing

The price floor drops.

Cost per 1M Output Tokens · June 2026
The Dependency Profile
GPT-5.6 Sol
$30.00
Claude Opus 4.8
$25.00
Gemini 3.1 Pro
$12.00
The Sovereignty Profile
GLM-5.2
$4.40
Qwen 3.7 Max
$3.75
DeepSeek V4 Flash
$0.28

Independently confirmed: open Chinese models run 60–90% cheaper than leading US models, and GLM-5.2 landed within one point of Claude Opus 4.8 on a watched agentic benchmark — at roughly a fifth of the cost. The frontier premium buys months, not moats.

~107× spread
Verify → A13
The Core Finding

Vendors are legally harvesting the cognitive trace — while you pay them to do it.

By classifying the outcome-verified reasoning trace — every accepted completion, every manually edited variable, every terminal-error correction — as "de-identified telemetry" or "usage metrics," vendors legally sidestep ZDR pledges. ZDR stays valid for raw text, which is now a depreciating asset. The premium resource for PRMs is the interactive logic path itself.

Enterprises are paying premium subscriptions to fund the automation of their own proprietary judgment.

The Polarity Hypothesis

Raw data (bits) is unipolar — it moves frictionlessly. Meaning, context and intent are multipolar — they depend on localized context and human agency. Harvesting interaction telemetry is the systematic capture of that agency.

Deployment concentration · HHI
4,100 1,705

A single-quarter collapse from monopolistic to competitive — a volume-driven migration toward sovereign, multi-model, open-weight architectures.

Read the fine print. Then change your architecture.

Verify → B5
Verification · Fact-checked July 13, 2026

Every claim traces to a primary source.

Evidence Library
30 primary-source cards — verbatim clauses, dual captures (live + archive), SHA-256 hashed.
Don't take our word for any of it. Every load-bearing claim above carries a card: the clause, the capture, and the hash. Verify everything yourself.
Open the Evidence Library →
The Standard
GRV-001 · The Autonomaton Pattern — sovereignty as a structural guarantee.
Operator-owned telemetry, config, and skills; the reasoning trace captured and kept locally. Open standard, CC BY 4.0.
Read GRV-001 at the-grove.ai →
The Grove Foundation · CC BY 4.0 · the-grove.ai
View as slideshow →
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship. Evidence Library →